Fallos del tipo CWE-74

4745 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-3178MEDIUMprojectworlds Online Doctor Appointment Booking System deleteappointment.php sql injectionEPSS 0.6%CVE-2025-3180MEDIUMprojectworlds Online Doctor Appointment Booking System deleteschedule.php sql injectionEPSS 0.6%CVE-2025-3265MEDIUMPHPGurukul e-Diary Management System add-category.php sql injectionEPSS 0.6%CVE-2025-3179MEDIUMprojectworlds Online Doctor Appointment Booking System deletepatient.php sql injectionEPSS 0.6%CVE-2024-12479MEDIUMcjbi wetech-cms TopicDao.java searchTopicByKeyword sql injectionEPSS 0.6%CVE-2021-39175HIGHXSS vector in slide mode speaker-viewEPSS 0.6%CVE-2025-7838MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_seat.php sql injectionEPSS 0.6%CVE-2024-12481MEDIUMcjbi wetech-cms UserDao.java findUser sql injectionEPSS 0.6%CVE-2025-4283MEDIUMSourceCodester/oretnom23 Stock Management System Login.php sql injectionEPSS 0.6%CVE-2022-4145MEDIUMContent spoofingEPSS 0.6%CVE-2026-48203CRITICALApache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fieldsEPSS 0.6%CVE-2025-0491MEDIUMFanli2012 native-php-cms cat_dodel.php sql injectionEPSS 0.6%CVE-2025-0967MEDIUMcode-projects Chat System add_chatroom.php sql injectionEPSS 0.6%CVE-2025-2054MEDIUMcode-projects Blood Bank Management System edit_state.php sql injectionEPSS 0.6%CVE-2025-0847MEDIUM1000 Projects Employee Task Management System Login index.php sql injectionEPSS 0.6%CVE-2025-2655MEDIUMSourceCodester AC Repair and Services System Users.php delete_users sql injectionEPSS 0.6%CVE-2025-5971MEDIUMcode-projects School Fees Payment System ajx.php sql injectionEPSS 0.6%CVE-2021-43929MEDIUMImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in EPSS 0.6%CVE-2025-67733HIGHValkey Affected by RESP Protocol Injection via Lua error_replyEPSS 0.6%CVE-2025-9662MEDIUMcode-projects Simple Grading System Admin Panel login.php sql injectionEPSS 0.6%